TKG DATA / DFIRBOT PRO

Forensic work, kept under your control.

DFIRBot Pro is a local-first investigation toolkit for repeatable collection, parsing, triage, timelines, and defensible findings.

What is included

A practical investigation toolkit

Repeatable workflows. Run collection, parsing, triage, and validation steps from one command-line workspace.
Evidence-aware output. Preserve context through timelines, graph relationships, rules, and machine-readable findings.
Local-first operation. Use the embedded service on your machine or connect to an FGIT/DFIRBot server you operate.
Broad platform support. Release builds are prepared for macOS, Linux, and Windows.

See the investigation workspace

Follow evidence through a timeline, inspect artifact metadata and hashes, and connect related files, processes, and network activity in one focused workspace.

A DFIRBot investigation session: SEGB parse results, notable annotations, and the investigative summary — A real session: parsed evidence, bookmarked annotations, and the investigative summary.

Case timeline grouping tool executions and audit events — Every tool run and audit event on the case timeline.

Evidence graph connecting the session, tools, and skills — The evidence graph: sessions, tools, and skills connected.

Native on the Mac

DFIRBot also ships a native macOS app: enter the license once, and it boots the local engine straight into your cases.

Native macOS app showing the case timeline — The evidence timeline: a ransomware burst and the log-clear that followed.

Native macOS app listing case artifacts with sizes — Artifacts and hashes.

Native macOS app with the Ask DFIRBot investigation prompt — Ask the engine, stream the answer.

License

One-time purchase · $150 USD

Pay once for DFIRBot Pro. There is no subscription, free tier, or trial edition.

Five devices

Activate up to five devices at the same time. You can remove an old device from the license portal.

Online activation

The application checks the license service when it starts. No forensic evidence is sent to the license service.

Plain delivery

Your license key is delivered to the email used during checkout and can be configured with DFIRBOT_LICENSE_KEY.

What stays local

DFIRBot processes investigative data in the workspace and server selected by you. The commercial license service handles only licensing records, device activation, and the payment email needed for delivery and support.

macOS · Linux · Windows · local-first · one-time license · five active devices

Downloads

Getting started

After purchase, download the release for your platform, set your license key, and start DFIRBot online once to activate the device.

export DFIRBOT_LICENSE_KEY="DFB-..."
dfirbot version

Secure payment

Payments are processed by iyzico. We accept Visa and Mastercard.

Payment and license delivery are subject to our Mesafeli Satış Sözleşmesi and Teslimat ve İade Şartları.